Monday, 8 August 2016

Install and Configure Nagios On CentOS

Nagios is an open source software that can be used for network and infrastructure monitoring. Nagios will monitor servers, switches, applications and services. It alerts the System Administrator when something went wrong and also alerts back when the issues has been rectified.
With Nagios you can:
– Monitor your entire IT infrastructure.
– Identify problems before they occur.
– Know immediately when problems arise.
– Share availability data with stakeholders.hypothetical question
– Detect security breaches.
– Plan and budget for IT upgrades.
– Reduce downtime and business losses.
Scenario
In this tutorial i am going to use two systems as mentioned below.

Nagios server:

Operating system : CentOS 6.5 minimal installation
IP Address       : 192.168.1.101/24

Nagios client:

Operating System : Ubuntu 13.04
IP Address       : 192.168.1.100/24
Prerequisites
Before installing Nagios, make sure that you’ve a properly installed and configured LAMP stack in your server. To install and configure LAMP server, refer any one of the following links.
Also install the following prerequisites too. All commands should be run as root user.
# yum install gd gd-devel gcc glibc glibc-common
Install Nagios
I tested this how-to on CentOS 6.5 minimal server, although it should work on all RHEL 6.x and its clones like CentOS 6.x and Scientific Linux 6.x.
Nagios will not be found in CentOS official repositories, so let us add the EPEL repository to install nagios. To add and enable EPEL repository, refer the following link.
Next install nagios with all plug-ins and nagios agents(nrpe-agent) using command:
# yum install nagios*
Note: It worked for me either if i keep SELINUX and iptables enable or disable. All you need to do is allow the apache port through iptables as shown below.
# vi /etc/sysconfig/iptables
Add the following line:
[...]
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
[...]
Save and close the file. Restart iptables.
# service iptables restart
Configure Nagios
Add the admin mail address in the nagios contact file to receive alerts from nagios server. To do that edit file/etc/nagios/objects/contacts.cfg,
# vi /etc/nagios/objects/contacts.cfg
Find the following line and enter the email id:
[...]
email                           sk@unixmen.com ;
[...
Save and close the file. Then Edit file/etc/httpd/conf.d/nagios.conf,
# vi /etc/httpd/conf.d/nagios.conf
And edit the following lines if you want to access nagios administrative console from a particular IP series. Here i want to allow nagios administrative access from 192.168.1.0/24 series only.
[...]
## Comment Lines 15 & 16 ##
#   Order allow,deny
#   Allow from all

## Uncomment and Change lines 17,18 & 19 as shown below ##
Order deny,allow
Deny from all
Allow from 127.0.0.1 192.168.1.0/24
[...]
Set nagiosadmin password
# htpasswd /etc/nagios/passwd nagiosadmin
New password:
Re-type new password:
Updating password for user nagiosadmin
Start nagios and httpd services and let them to start automatically on every boot.
# service nagios start
# service httpd start
# chkconfig nagios on
# chkconfig httpd on
Access Nagios admin console
Open nagios administrator console with URL http://nagios-server-ip/nagios and enter the username as nagiosadmin and its password which we created in the earlier steps.
New Tab - Mozilla Firefox_001This is how Nagios administrative console looks:
Nagios Core - Mozilla Firefox_002Click on the “Hosts” section in the left pane of the console. You will see the no of hosts to be monitored by Nagios server. Initially, the nagios server (localhost) itself will only be monitored.
Nagios Core - Mozilla Firefox_003Click on the monitoring host to display more details:
Nagios Core - Mozilla Firefox_004

Add Monitoring targets to Nagios server
Now let us add some clients to monitor by Nagios server. To do that we have to install nrpe and nagios-plugins in our monitoring targets.
On CentOS/RHEL/Scientifc Linux clients:
Like i said before, you have to add EPEL repository in your CentOS/RHEL/Scientific Linux 6.x clients to install nrpepackage.
Install “nrpe” and “nagios-plugins” packages in client systems to be monitored.
# yum install nrpe nagios-plugins-all openssl
On Debian/Ubuntu clients:
$ sudo apt-get install nagios-nrpe-server nagios-plugins
Configure Monitoring targets
Edit /etc/nagios/nrpe.cfg file,
# vi /etc/nagios/nrpe.cfg
Add your Nagios server ip address
[...]
## Line 81 - Add the Nagios server IP ##
allowed_hosts=127.0.0.1 192.168.1.101
[...]
Start nrpe service:
# service nrpe start
# chkconfig nrpe on
For Debian/Ubuntu Clients, start nrpe service as shown below.
$ sudo /etc/init.d/nagios-nrpe-server restart
Now go back to your Nagios server to add the clients to be monitored through nagios server. Edit“/etc/nagios/nagios.cfg” file,
# vi /etc/nagios/nagios.cfg
and uncomment the following lines.
## Line 52 - Uncomment ##
cfg_dir=/etc/nagios/servers
Create a directory called “servers” under “/etc/nagios/”.
# mkdir /etc/nagios/servers
Create config file to the client to be monitored:
# vi /etc/nagios/servers/clients.cfg
define host{

use                             linux-server

host_name                       client

alias                           client

address                         192.168.1.100

max_check_attempts              5

check_period                    24x7

notification_interval           30

notification_period             24x7

}
Finally restart nagios service.
# service nagios restart
Now open the nagios admin console in the browser and navigate to “Hosts” section in the left pane. You will see the newly added client will be visible there. Click on the host to see if there is anything wrong or alerts.
Nagios Core - Mozilla Firefox_005Click on the monitoring target, you’ll get the detailed output:
Nagios Core - Mozilla Firefox_006Like this way, you can define more clients by creating a separate config files “/etc/nagios/servers directory for each client.
Define services
We did define the monitoring host before. Now let us add some services of the monitoring host. For example to monitor the ssh service, add the following lines shown in red colour in the/etc/nagios/servers/clients.cfg file.
# vi /etc/nagios/servers/clients.cfg
define host{

use                             linux-server

host_name                       client

alias                           client

address                         192.168.1.100

max_check_attempts              5

check_period                    24x7

notification_interval           30

notification_period             24x7

}

define service {
        use                             generic-service
        host_name                       client
        service_description             SSH
        check_command                   check_ssh
        notifications_enabled           0
        }
Save and close the file. Restart Nagios.
# service nagios restart
Now log in to Nagios web console and check for the added services. Navigate to Services section, you’ll see the ssh service there.
Nagios Core - Mozilla Firefox_008To know more about object definitions such as Host definitions, service definitions, contact definitions and more please do visit here. This page will describe you the description and format of all object definitions.

Thursday, 28 July 2016

How to install and configure a SysLog Server

The following document describes how to install and configure a SysLog Server on a CentOS 6.5 Linux Operating System. The steps described below can also be applied to other distributions with very minor corrections. For more information check the corresponding documentation.

The solution is based on three main component:

LAMP stack (Linux, Apache, MySQL, PHP)
Rsyslog server http://www.rsyslog.com/
LogAnalyzer http://loganalyzer.adiscon.com/

This guide assumes that both SELinux and IPTables are disabled and not running. If that kind of security level is necessary, check the proper documentation.

Apache

To install Apache Web server open a root command line and type:
[root@localhost ]# yum install httpd

Start the server:
[root@localhost ]# service httpd start

Set automatically start the server at boot time:
[root@localhost ]# chkconfig httpd on

Test the Apache installation:

Open http://localhost or http://your-server-address on your web browser of choice and check if Apache is working. You should see a page like this:

MySQL

To install MySQL database, open a root command line and type:
[root@localhost ]# yum install mysql mysql-server

Start the server:
[root@localhost ]# service mysqld start 

Set the server to automatically start on boot:
[root@localhost ]# chkconfig mysql on 

Change the MySQL root user password
[root@localhost ]# mysqladmin -u root password 'changeMe' 

Test the MySQL installation.

Log in to the database:
[root@localhost ]# mysql -u root -p 

You should receive an output like this:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 9
Server version: 5.1.73 Source distribution

Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights
reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input
statement.

mysql>

Type 'exit' to log out:

mysql> exit

PHP

To install PHP open a root command line and type:
[root@localhost ]# yum install php php-mysql

Create a simple test page to test the installation, by using your editor of choice:
[root@localhost ]# nano /var/www/html/test.php

Insert the following content:
<?php 
    phpinfo(); 
?>

Save and close.

Restart the web server:
[root@localhost ]# service httpd restart

Open http://localhost/test.php or http://your-server-address/test.php on your web browser of choice. You should receive a page like this:

Rsyslog

To install Rsyslog server, open a root command line and type:
[root@localhost ]# yum install rsyslog*

Start the server:
[root@localhost ]# service rsyslog start 

Set automatically start the server at boot time:
[root@localhost ]# chkconfig rsyslog on

Rename the Rsyslog database:
[root@localhost ]# nano /usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql

From Syslog to rsyslogdb
CREATE DATABASE rsyslogdb; 
USE rsyslogdb; 
CREATE TABLE SystemEvents ( 
[...]

Create the rsyslogdb database:
[root@localhost ]# mysql -u root -p < /usr/share/doc/rsyslog-mysql-5.8.10/createDB.sql

Now you should be able to access the database:
[root@localhost ]# mysql -u root -p rsyslogdb

Create a dedicated user to access the Rsyslog database:
mysql> GRANT ALL ON rsyslogdb.* TO rsysloguser@localhost IDENTIFIED BY 'changeMe';
 
mysql> FLUSH PRIVILEGES;

mysql> exit

Test if you can access the database with the new user typing:
[root@localhost ]# mysql -u rsysloguser -p rsyslogdb

Configure the Rsyslog server in order to use MySQL.

Open the configuration file:
[root@localhost ]# nano /etc/rsyslog.conf

Uncomment the following modules:
$ModLoad imudp 
$UDPServerRun 514 

# Provides TCP syslog reception 
$ModLoad imtcp 
$InputTCPServerRun 514 

Add the MySQL module:
$ModLoad ommysql

Add the forwarding rule:
*.* :ommysql:127.0.0.1,rsyslogdb,rsysloguser,changeMe

where:
127.0.0.1 - mysql server address
rsyslogdb - mysql rsyslog database name
rsysloguser - mysql rsyslog database user username
changeMe - mysql rsyslog database user password

Save and exit.

Restart the Rsyslog server in order to load the new configuration:
[root@localhost ]# service rsyslog restart

You should be able to see the log entry in the database:
[root@localhost ]# mysql -u rsysloguser -p rsyslogdb

mysql> select count(*) from SystemEvents;
+----------+
| count(*) |
+----------+
|        2 |
+----------+

You should have a count number greater than ZERO. If not, wait a few seconds in order to let Rsyslog to generate log entries.


Hint:


To send a test message to the log:
[root@localhost ]# echo '<14>ip_address_here tag_here message here' | nc -v -u -w 0 127.0.0.1 514

LogAnalyzer

Download the latest version of the software (when this document was written, it was 3.6.5):
[root@localhost ]# wget http://download.adiscon.com/loganalyzer/loganalyzer-3.6.5.tar.gz

Unpack the tarball:
[root@localhost ]# tar zxvf loganalyzer-3.6.5.tar.gz

Copy installation files to the desired folder:
[root@localhost ]# cp -r loganalyzer-3.6.5/src/ /var/www/html/loganalyzer
[root@localhost ]# cp -r loganalyzer-3.6.5/contrib/* /var/www/html/loganalyzer/

Change directory to the installation folder:
[root@localhost ]# cd /var/www/html/loganalyzer/

Add the execution permission to the following files:
[root@localhost ]# chmod +x configure.sh secure.sh

Now run ./configure.sh. This will create a blank config.php, and will also set write access to everyone to it.
[root@localhost ]# ./configure.sh

To complete the installation open http://localhost/loganalyzer or http://your-server-address/loganalyzer on your web browser of choice. You should receive an error page like this:

Click on here link and start the guided installation process:

Step 1

Simply click Next to start the process.

Step 2

Simply click Next to continue the process.

Step 3

Enable the user database to secure the UI access and fill the fields accordingly

Step 4

Simply click Next to continue the process.

Step 5

Simply click Next to continue the process.

Step 6

Create a user in order to access the LogAnalyzer web interface. In the example we create a user admin/admin, fill the fields and click Next to continue the process.

Step 7

Create the first source for Syslog messages. Fill the fields and then click Next to continue the process.

Step 8

Simply click Next to continue the process. 


The installation is complete.

Step 9

Log in the web UI with the credentials created in Step 6

Step 10

Congratulations! You have successfully installed and configured your logging solution.
 

Install rsyslog package in your client systems.
For RHEl/CentOS Clients:
# yum install rsyslog -y
For Debian/Ubuntu Clients:
$ sudo apt-get install rsyslog
Open the rsyslog config file and the rsyslog server details.
# vi /etc/rsyslog.conf
Add Rsyslog server details:
*.*     @@192.168.54.102
and start rsyslog services.
# service rsyslog start 
# chkconfig rsyslog on
Now goto rsyslog server and check for client logs.

As you see in the above screenshot my client GitLab has been added and log details are shown in the LogAnalyzer admin console.

Troubleshooting

After login you may receive the error message:
could not find the configured table, maybe misspelled or the table names are case sensitive

This error is often due to wrong syntax in the DBTableName field. To fix it you need to edit the /var/www/html/loganalyzer/config.php file and check if the DBTableName value is written with the correct capital letters.
SystemEvents
# vi /var/www/html/loganalyzer/config.php

Amended the DBTableName value, the system should work properly.